GCash belies data breach

The country’s leading super-app, GCash, said there is no evidence of a data breach that happened on Monday, assuring millions of GCash app users that their funds and information remain safe and secure.

“GCash is aware of an online post alleging that user information is being sold on the dark web. There is no evidence of any breach in GCash systems. All customer accounts and funds remain secure. Upon swift investigation of our cybersecurity experts, the alleged dataset does not match data from GCash systems. Additionally, many entries are incomplete, invalid, or do not belong to GCash users,” GCash said in a statement.

The fintech giant further stressed that these findings strongly indicate that the data being circulated did not originate from GCash.

“We continue to work closely with the Bangko Sentral ng Pilipinas, National Privacy Commission (NPC), and Cybercrime Investigation Coordination Center to monitor and validate information from all possible sources and ensure that our systems remain protected. GCash remains fully committed to safeguarding customer data, strengthening our defenses, and upholding the trust of millions of Filipinos,” it said.

NPC probing

Meanwhile, the NPC likewise on Monday urged the public to exercise heightened vigilance following reports of a data leak allegedly involving G-Xchange, Inc., operator of GCash.

The privacy vanguard disclosed that they have immediately launched an investigation after a dark web post appeared claiming to sell user information.

“The post, made by a threat actor using the alias “Oversleep8351,” allegedly offers merchant and basic user data, GCash account numbers, linked bank and virtual card accounts, and KYC (Know Your Customer) records containing names, addresses, employment details and valid Philippine IDs,” the NPC said.